Unable to process compressed events on the Notification Server
Last Updated March 03, 2009
Clients are able to successfully compress events over a certain size and post them to the server with no errors in the agent logs nor the server logs.
However, the data is not being processed at the server and a new zero byte nse (tmp file) is created in the server's NSCap\Temp folder each time a compressed nse is posted from a client computer.
There were no errors that could be found in the log files for the Notification Server or the Altiris Profiler but a wireshark trace file was captured on the Notification Server that had the following information:
Event not processed. Error number 80041002. Error description: Failed to understand given event data.
The Identity account used for the DefaultAppPool did not have sufficient folder permissions on the NSCap\Temp folder.
The following share and file system permissions are the minimum that have been found to work: